That basically exists, look at BGP blackholes. Fairly well supported, and it works at what it does, but it can be too blunt of a tool, because it blackholes by destination, not by source.

Border routers are wired to make forwarding decisions based on destination addresses, and not source addresses, so options are limited. Even if you could blackhole by source/dest pair, the distributed nature of DDoS means thousands of sources, which means thousands of rules/routes, which isn't ideal. Some providers might have some capacity to do smarter filters, but it's limited and not very standardized.

If you're dealing with volumetric DDoS, the simple reality is you need big pipes if you want to accept the traffic. Otherwise, cycle IPs and hope legit traffic finds new IPs faster than abusers do. Run your backend communication over a separate network or at least totally separate IP space, so at least you're not losing management capability while under attack.

DDoS mitigation should be a complimentary business with CDN, becuase the traffic flows are opposite of usual, and CDNs generally connect with symetric connections, so what were they going to do with the inbound bandwidth anyway? But that doesn't mean all CDNs run that line of business.

So if someone becomes part of the bonnet, they are denied all access to the internet

Isn't that good though? Unblock them when they fix their host.

(I am not a lawyer) I don't know how legal it actually is, how enforceable it is, and if the whole marker applies those, but my ISP contract has provisions that says I'm not authorized to invade or damage third parties using their internet service.